[Bro-Dev] Writing analyzer for Siemens PLC
robin at icir.org
Thu May 3 18:16:28 PDT 2018
On Wed, May 02, 2018 at 22:22 +0200, you wrote:
> 1) Reassembling packets: Some S7CommPlus packets which payload is over a
> certain amount of bytes will be split and need to be reassembled.
As a couple quick pointers, the DNP3 and DTLS analyzers face a similar
task, you might find some ideas there.
> If I want to generate a Bro events which contains the payload as a
> parameter, how do I do that?
If with "payload" you mean the raw bytes, you would pass that as a
string into the event. But it's hard to do much with raw data that in
script-land. The common way would be instead creating one event per
type of payload and then raising the corresponding event as you parse
packets and find out what's in there.
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin
More information about the bro-dev